Splunk Search

regex not working

reverse
Contributor

https://regex101.com/r/PNYxi2/2

not working in splunk.

Error in 'rex' command: Encountered the following error while compiling the regex '(?<v1>.+:\.+?\(.+?)\.+)': Regex: unmatched closing parenthesis
0 Karma
1 Solution

Vijeta
Influencer

@reverse - A backslash seems to be misplaced in your expression. It should be '(?<v1>.+:\.+?\(.+?\).+)':

View solution in original post

Vijeta
Influencer

@reverse - A backslash seems to be misplaced in your expression. It should be '(?<v1>.+:\.+?\(.+?\).+)':

jazzypai
Path Finder

Try out the following as for regex101.com

(?<drive>\w)\:\\(?<first>[\w]+)\\(?<second>[\w]+)\\(?<third>[\w]+)\\(?<filename>[\d\w\.]+)

Try this out in splunk;

 | rex field=string "(?<drive>\w)\:\\\(?<first>[\w]+)\\\(?<second>[\w]+)\\\(?<third>[\w]+)\\\(?<filename>[\d\w\.]+)"

This will parse the entire path that you listed.

saurabhkharkar
Path Finder

what are you trying to parse ?

0 Karma

reverse
Contributor

I want to extract DEF.

0 Karma

reverse
Contributor
0 Karma

jazzypai
Path Finder

Do you want to extract DEF or do you want to extract the name of the second directory, where DEF is located?

0 Karma

reverse
Contributor

name of the second directory

0 Karma

saurabhkharkar
Path Finder
| makeresults
| eval string ="c:\ABC\DEF\LOGS\1.LOG"
| rex field=string ".*?\\\\\w+\\\(?<extract_attribute>\w+).+"
| table string extract_attribute
Get Updates on the Splunk Community!

Enhance Your Splunk App Development: New Tools & Support

UCC FrameworkAdd-on Builder has been around for quite some time. It helps build Splunk apps faster, but it ...

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...